xref: /freebsd/crypto/openssh/ssh-keygen.1 (revision 4a421b6336e5e0c2ff27024c30fe32c6f71dcf3d)
1*4a421b63SDag-Erling Smørgrav.\"	$OpenBSD: ssh-keygen.1,v 1.101 2010/10/28 18:33:28 jmc Exp $
2cce7d346SDag-Erling Smørgrav.\"	$FreeBSD$
31e8db6e2SBrian Feldman.\"
4511b41d2SMark Murray.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
5511b41d2SMark Murray.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6511b41d2SMark Murray.\"                    All rights reserved
7511b41d2SMark Murray.\"
8b66f2d16SKris Kennaway.\" As far as I am concerned, the code I have written for this software
9b66f2d16SKris Kennaway.\" can be used freely for any purpose.  Any derived versions of this
10b66f2d16SKris Kennaway.\" software must be clearly marked as such, and if the derived work is
11b66f2d16SKris Kennaway.\" incompatible with the protocol description in the RFC file, it must be
12b66f2d16SKris Kennaway.\" called by a name other than "ssh" or "Secure Shell".
13511b41d2SMark Murray.\"
14b66f2d16SKris Kennaway.\"
15b66f2d16SKris Kennaway.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
16b66f2d16SKris Kennaway.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
17b66f2d16SKris Kennaway.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
18b66f2d16SKris Kennaway.\"
19b66f2d16SKris Kennaway.\" Redistribution and use in source and binary forms, with or without
20b66f2d16SKris Kennaway.\" modification, are permitted provided that the following conditions
21b66f2d16SKris Kennaway.\" are met:
22b66f2d16SKris Kennaway.\" 1. Redistributions of source code must retain the above copyright
23b66f2d16SKris Kennaway.\"    notice, this list of conditions and the following disclaimer.
24b66f2d16SKris Kennaway.\" 2. Redistributions in binary form must reproduce the above copyright
25b66f2d16SKris Kennaway.\"    notice, this list of conditions and the following disclaimer in the
26b66f2d16SKris Kennaway.\"    documentation and/or other materials provided with the distribution.
27b66f2d16SKris Kennaway.\"
28b66f2d16SKris Kennaway.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
29b66f2d16SKris Kennaway.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
30b66f2d16SKris Kennaway.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
31b66f2d16SKris Kennaway.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
32b66f2d16SKris Kennaway.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
33b66f2d16SKris Kennaway.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34b66f2d16SKris Kennaway.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35b66f2d16SKris Kennaway.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36b66f2d16SKris Kennaway.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
37b66f2d16SKris Kennaway.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38511b41d2SMark Murray.\"
39*4a421b63SDag-Erling Smørgrav.Dd October 28, 2010
40511b41d2SMark Murray.Dt SSH-KEYGEN 1
41511b41d2SMark Murray.Os
42511b41d2SMark Murray.Sh NAME
43511b41d2SMark Murray.Nm ssh-keygen
441e8db6e2SBrian Feldman.Nd authentication key generation, management and conversion
45511b41d2SMark Murray.Sh SYNOPSIS
46d0c8c0bcSDag-Erling Smørgrav.Bk -words
47e2f6069cSDag-Erling Smørgrav.Nm ssh-keygen
481e8db6e2SBrian Feldman.Op Fl q
49511b41d2SMark Murray.Op Fl b Ar bits
50ae1f160dSDag-Erling Smørgrav.Fl t Ar type
51511b41d2SMark Murray.Op Fl N Ar new_passphrase
52511b41d2SMark Murray.Op Fl C Ar comment
53b66f2d16SKris Kennaway.Op Fl f Ar output_keyfile
54511b41d2SMark Murray.Nm ssh-keygen
55511b41d2SMark Murray.Fl p
56511b41d2SMark Murray.Op Fl P Ar old_passphrase
57511b41d2SMark Murray.Op Fl N Ar new_passphrase
58511b41d2SMark Murray.Op Fl f Ar keyfile
59511b41d2SMark Murray.Nm ssh-keygen
601e8db6e2SBrian Feldman.Fl i
61e2f6069cSDag-Erling Smørgrav.Op Fl m Ar key_format
62b66f2d16SKris Kennaway.Op Fl f Ar input_keyfile
63a04a10f8SKris Kennaway.Nm ssh-keygen
641e8db6e2SBrian Feldman.Fl e
65e2f6069cSDag-Erling Smørgrav.Op Fl m Ar key_format
66b66f2d16SKris Kennaway.Op Fl f Ar input_keyfile
67a04a10f8SKris Kennaway.Nm ssh-keygen
68a04a10f8SKris Kennaway.Fl y
69b66f2d16SKris Kennaway.Op Fl f Ar input_keyfile
70a04a10f8SKris Kennaway.Nm ssh-keygen
71511b41d2SMark Murray.Fl c
72511b41d2SMark Murray.Op Fl P Ar passphrase
73511b41d2SMark Murray.Op Fl C Ar comment
74511b41d2SMark Murray.Op Fl f Ar keyfile
75511b41d2SMark Murray.Nm ssh-keygen
76511b41d2SMark Murray.Fl l
77b66f2d16SKris Kennaway.Op Fl f Ar input_keyfile
78a04a10f8SKris Kennaway.Nm ssh-keygen
791e8db6e2SBrian Feldman.Fl B
801e8db6e2SBrian Feldman.Op Fl f Ar input_keyfile
81ae1f160dSDag-Erling Smørgrav.Nm ssh-keygen
82b15c8340SDag-Erling Smørgrav.Fl D Ar pkcs11
83ae1f160dSDag-Erling Smørgrav.Nm ssh-keygen
845e8dbd04SDag-Erling Smørgrav.Fl F Ar hostname
855e8dbd04SDag-Erling Smørgrav.Op Fl f Ar known_hosts_file
86cce7d346SDag-Erling Smørgrav.Op Fl l
875e8dbd04SDag-Erling Smørgrav.Nm ssh-keygen
885e8dbd04SDag-Erling Smørgrav.Fl H
895e8dbd04SDag-Erling Smørgrav.Op Fl f Ar known_hosts_file
905e8dbd04SDag-Erling Smørgrav.Nm ssh-keygen
915e8dbd04SDag-Erling Smørgrav.Fl R Ar hostname
925e8dbd04SDag-Erling Smørgrav.Op Fl f Ar known_hosts_file
935e8dbd04SDag-Erling Smørgrav.Nm ssh-keygen
94d95e11bfSDag-Erling Smørgrav.Fl r Ar hostname
95d95e11bfSDag-Erling Smørgrav.Op Fl f Ar input_keyfile
96d95e11bfSDag-Erling Smørgrav.Op Fl g
97d95e11bfSDag-Erling Smørgrav.Nm ssh-keygen
98d95e11bfSDag-Erling Smørgrav.Fl G Ar output_file
99efcad6b7SDag-Erling Smørgrav.Op Fl v
100d95e11bfSDag-Erling Smørgrav.Op Fl b Ar bits
101d95e11bfSDag-Erling Smørgrav.Op Fl M Ar memory
102d95e11bfSDag-Erling Smørgrav.Op Fl S Ar start_point
103d95e11bfSDag-Erling Smørgrav.Nm ssh-keygen
104d95e11bfSDag-Erling Smørgrav.Fl T Ar output_file
105d95e11bfSDag-Erling Smørgrav.Fl f Ar input_file
106efcad6b7SDag-Erling Smørgrav.Op Fl v
107d95e11bfSDag-Erling Smørgrav.Op Fl a Ar num_trials
108d95e11bfSDag-Erling Smørgrav.Op Fl W Ar generator
109b15c8340SDag-Erling Smørgrav.Nm ssh-keygen
110b15c8340SDag-Erling Smørgrav.Fl s Ar ca_key
111b15c8340SDag-Erling Smørgrav.Fl I Ar certificate_identity
112b15c8340SDag-Erling Smørgrav.Op Fl h
113b15c8340SDag-Erling Smørgrav.Op Fl n Ar principals
114e2f6069cSDag-Erling Smørgrav.Op Fl O Ar option
115b15c8340SDag-Erling Smørgrav.Op Fl V Ar validity_interval
116e2f6069cSDag-Erling Smørgrav.Op Fl z Ar serial_number
117b15c8340SDag-Erling Smørgrav.Ar
118b15c8340SDag-Erling Smørgrav.Nm ssh-keygen
119b15c8340SDag-Erling Smørgrav.Fl L
120b15c8340SDag-Erling Smørgrav.Op Fl f Ar input_keyfile
121b15c8340SDag-Erling Smørgrav.Ek
122511b41d2SMark Murray.Sh DESCRIPTION
123511b41d2SMark Murray.Nm
1241e8db6e2SBrian Feldmangenerates, manages and converts authentication keys for
125511b41d2SMark Murray.Xr ssh 1 .
126a04a10f8SKris Kennaway.Nm
127*4a421b63SDag-Erling Smørgravcan create RSA keys for use by SSH protocol version 1 and DSA, ECDSA or RSA
128d95e11bfSDag-Erling Smørgravkeys for use by SSH protocol version 2.
129d95e11bfSDag-Erling SmørgravThe type of key to be generated is specified with the
1301e8db6e2SBrian Feldman.Fl t
131ae1f160dSDag-Erling Smørgravoption.
132021d409fSDag-Erling SmørgravIf invoked without any arguments,
133021d409fSDag-Erling Smørgrav.Nm
134021d409fSDag-Erling Smørgravwill generate an RSA key for use in SSH protocol 2 connections.
135a04a10f8SKris Kennaway.Pp
136d95e11bfSDag-Erling Smørgrav.Nm
137d95e11bfSDag-Erling Smørgravis also used to generate groups for use in Diffie-Hellman group
138d95e11bfSDag-Erling Smørgravexchange (DH-GEX).
139d95e11bfSDag-Erling SmørgravSee the
140d95e11bfSDag-Erling Smørgrav.Sx MODULI GENERATION
141d95e11bfSDag-Erling Smørgravsection for details.
142d95e11bfSDag-Erling Smørgrav.Pp
143511b41d2SMark MurrayNormally each user wishing to use SSH
144*4a421b63SDag-Erling Smørgravwith public key authentication runs this once to create the authentication
145511b41d2SMark Murraykey in
146043840dfSDag-Erling Smørgrav.Pa ~/.ssh/identity ,
147*4a421b63SDag-Erling Smørgrav.Pa ~/.ssh/id_ecdsa ,
148043840dfSDag-Erling Smørgrav.Pa ~/.ssh/id_dsa
149a04a10f8SKris Kennawayor
150043840dfSDag-Erling Smørgrav.Pa ~/.ssh/id_rsa .
151a04a10f8SKris KennawayAdditionally, the system administrator may use this to generate host keys,
152a04a10f8SKris Kennawayas seen in
153a04a10f8SKris Kennaway.Pa /etc/rc .
154511b41d2SMark Murray.Pp
155511b41d2SMark MurrayNormally this program generates the key and asks for a file in which
156a8f6863aSKris Kennawayto store the private key.
157a8f6863aSKris KennawayThe public key is stored in a file with the same name but
158511b41d2SMark Murray.Dq .pub
159a8f6863aSKris Kennawayappended.
160a8f6863aSKris KennawayThe program also asks for a passphrase.
161a8f6863aSKris KennawayThe passphrase may be empty to indicate no passphrase
1621e8db6e2SBrian Feldman(host keys must have an empty passphrase), or it may be a string of
163a8f6863aSKris Kennawayarbitrary length.
164ae1f160dSDag-Erling SmørgravA passphrase is similar to a password, except it can be a phrase with a
165ae1f160dSDag-Erling Smørgravseries of words, punctuation, numbers, whitespace, or any string of
166ae1f160dSDag-Erling Smørgravcharacters you want.
167ae1f160dSDag-Erling SmørgravGood passphrases are 10-30 characters long, are
168511b41d2SMark Murraynot simple sentences or otherwise easily guessable (English
169ae1f160dSDag-Erling Smørgravprose has only 1-2 bits of entropy per character, and provides very bad
170ae1f160dSDag-Erling Smørgravpassphrases), and contain a mix of upper and lowercase letters,
171ae1f160dSDag-Erling Smørgravnumbers, and non-alphanumeric characters.
172a8f6863aSKris KennawayThe passphrase can be changed later by using the
173511b41d2SMark Murray.Fl p
174511b41d2SMark Murrayoption.
175511b41d2SMark Murray.Pp
176a8f6863aSKris KennawayThere is no way to recover a lost passphrase.
177a8f6863aSKris KennawayIf the passphrase is
178ae1f160dSDag-Erling Smørgravlost or forgotten, a new key must be generated and copied to the
179511b41d2SMark Murraycorresponding public key to other machines.
180511b41d2SMark Murray.Pp
1811e8db6e2SBrian FeldmanFor RSA1 keys,
1821e8db6e2SBrian Feldmanthere is also a comment field in the key file that is only for
183a8f6863aSKris Kennawayconvenience to the user to help identify the key.
184a8f6863aSKris KennawayThe comment can tell what the key is for, or whatever is useful.
185a8f6863aSKris KennawayThe comment is initialized to
186511b41d2SMark Murray.Dq user@host
187511b41d2SMark Murraywhen the key is created, but can be changed using the
188511b41d2SMark Murray.Fl c
189511b41d2SMark Murrayoption.
190511b41d2SMark Murray.Pp
191a04a10f8SKris KennawayAfter a key is generated, instructions below detail where the keys
192a04a10f8SKris Kennawayshould be placed to be activated.
193a04a10f8SKris Kennaway.Pp
194511b41d2SMark MurrayThe options are as follows:
195511b41d2SMark Murray.Bl -tag -width Ds
196d95e11bfSDag-Erling Smørgrav.It Fl a Ar trials
197d95e11bfSDag-Erling SmørgravSpecifies the number of primality tests to perform when screening DH-GEX
198d95e11bfSDag-Erling Smørgravcandidates using the
199d95e11bfSDag-Erling Smørgrav.Fl T
200d95e11bfSDag-Erling Smørgravcommand.
2015e8dbd04SDag-Erling Smørgrav.It Fl B
2025e8dbd04SDag-Erling SmørgravShow the bubblebabble digest of specified private or public key file.
203511b41d2SMark Murray.It Fl b Ar bits
204a8f6863aSKris KennawaySpecifies the number of bits in the key to create.
205021d409fSDag-Erling SmørgravFor RSA keys, the minimum size is 768 bits and the default is 2048 bits.
206043840dfSDag-Erling SmørgravGenerally, 2048 bits is considered sufficient.
207021d409fSDag-Erling SmørgravDSA keys must be exactly 1024 bits as specified by FIPS 186-2.
2085e8dbd04SDag-Erling Smørgrav.It Fl C Ar comment
2095e8dbd04SDag-Erling SmørgravProvides a new comment.
210511b41d2SMark Murray.It Fl c
211511b41d2SMark MurrayRequests changing the comment in the private and public key files.
212ae1f160dSDag-Erling SmørgravThis operation is only supported for RSA1 keys.
213511b41d2SMark MurrayThe program will prompt for the file containing the private keys, for
214ae1f160dSDag-Erling Smørgravthe passphrase if the key has one, and for the new comment.
215b15c8340SDag-Erling Smørgrav.It Fl D Ar pkcs11
216b15c8340SDag-Erling SmørgravDownload the RSA public keys provided by the PKCS#11 shared library
217b15c8340SDag-Erling Smørgrav.Ar pkcs11 .
218e2f6069cSDag-Erling SmørgravWhen used in combination with
219e2f6069cSDag-Erling Smørgrav.Fl s ,
220e2f6069cSDag-Erling Smørgravthis option indicates that a CA key resides in a PKCS#11 token (see the
221e2f6069cSDag-Erling Smørgrav.Sx CERTIFICATES
222e2f6069cSDag-Erling Smørgravsection for details).
2231e8db6e2SBrian Feldman.It Fl e
2241e8db6e2SBrian FeldmanThis option will read a private or public OpenSSH key file and
225e2f6069cSDag-Erling Smørgravprint to stdout the key in one of the formats specified by the
226e2f6069cSDag-Erling Smørgrav.Fl m
227e2f6069cSDag-Erling Smørgravoption.
228e2f6069cSDag-Erling SmørgravThe default export format is
229e2f6069cSDag-Erling Smørgrav.Dq RFC4716 .
230e2f6069cSDag-Erling SmørgravThis option allows exporting OpenSSH keys for use by other programs, including
231e2f6069cSDag-Erling Smørgravseveral commercial SSH implementations.
2325e8dbd04SDag-Erling Smørgrav.It Fl F Ar hostname
2335e8dbd04SDag-Erling SmørgravSearch for the specified
2345e8dbd04SDag-Erling Smørgrav.Ar hostname
2355e8dbd04SDag-Erling Smørgravin a
2365e8dbd04SDag-Erling Smørgrav.Pa known_hosts
2375e8dbd04SDag-Erling Smørgravfile, listing any occurrences found.
2385e8dbd04SDag-Erling SmørgravThis option is useful to find hashed host names or addresses and may also be
2395e8dbd04SDag-Erling Smørgravused in conjunction with the
2405e8dbd04SDag-Erling Smørgrav.Fl H
2415e8dbd04SDag-Erling Smørgravoption to print found keys in a hashed format.
2425e8dbd04SDag-Erling Smørgrav.It Fl f Ar filename
2435e8dbd04SDag-Erling SmørgravSpecifies the filename of the key file.
2445e8dbd04SDag-Erling Smørgrav.It Fl G Ar output_file
2455e8dbd04SDag-Erling SmørgravGenerate candidate primes for DH-GEX.
2465e8dbd04SDag-Erling SmørgravThese primes must be screened for
2475e8dbd04SDag-Erling Smørgravsafety (using the
2485e8dbd04SDag-Erling Smørgrav.Fl T
2495e8dbd04SDag-Erling Smørgravoption) before use.
250d95e11bfSDag-Erling Smørgrav.It Fl g
251d74d50a8SDag-Erling SmørgravUse generic DNS format when printing fingerprint resource records using the
252d74d50a8SDag-Erling Smørgrav.Fl r
253d74d50a8SDag-Erling Smørgravcommand.
2545e8dbd04SDag-Erling Smørgrav.It Fl H
2555e8dbd04SDag-Erling SmørgravHash a
2565e8dbd04SDag-Erling Smørgrav.Pa known_hosts
2574518870cSDag-Erling Smørgravfile.
2584518870cSDag-Erling SmørgravThis replaces all hostnames and addresses with hashed representations
2594518870cSDag-Erling Smørgravwithin the specified file; the original content is moved to a file with
2604518870cSDag-Erling Smørgrava .old suffix.
2615e8dbd04SDag-Erling SmørgravThese hashes may be used normally by
2625e8dbd04SDag-Erling Smørgrav.Nm ssh
2635e8dbd04SDag-Erling Smørgravand
2645e8dbd04SDag-Erling Smørgrav.Nm sshd ,
2655e8dbd04SDag-Erling Smørgravbut they do not reveal identifying information should the file's contents
2665e8dbd04SDag-Erling Smørgravbe disclosed.
2675e8dbd04SDag-Erling SmørgravThis option will not modify existing hashed hostnames and is therefore safe
2685e8dbd04SDag-Erling Smørgravto use on files that mix hashed and non-hashed names.
269b15c8340SDag-Erling Smørgrav.It Fl h
270b15c8340SDag-Erling SmørgravWhen signing a key, create a host certificate instead of a user
271b15c8340SDag-Erling Smørgravcertificate.
272b15c8340SDag-Erling SmørgravPlease see the
273b15c8340SDag-Erling Smørgrav.Sx CERTIFICATES
274b15c8340SDag-Erling Smørgravsection for details.
275b15c8340SDag-Erling Smørgrav.It Fl I Ar certificate_identity
276b15c8340SDag-Erling SmørgravSpecify the key identity when signing a public key.
277b15c8340SDag-Erling SmørgravPlease see the
278b15c8340SDag-Erling Smørgrav.Sx CERTIFICATES
279b15c8340SDag-Erling Smørgravsection for details.
2801e8db6e2SBrian Feldman.It Fl i
2811e8db6e2SBrian FeldmanThis option will read an unencrypted private (or public) key file
282e2f6069cSDag-Erling Smørgravin the format specified by the
283e2f6069cSDag-Erling Smørgrav.Fl m
284e2f6069cSDag-Erling Smørgravoption and print an OpenSSH compatible private
2851e8db6e2SBrian Feldman(or public) key to stdout.
286e2f6069cSDag-Erling SmørgravThis option allows importing keys from other software, including several
287e2f6069cSDag-Erling Smørgravcommercial SSH implementations.
288e2f6069cSDag-Erling SmørgravThe default import format is
289e2f6069cSDag-Erling Smørgrav.Dq RFC4716 .
290b15c8340SDag-Erling Smørgrav.It Fl L
291b15c8340SDag-Erling SmørgravPrints the contents of a certificate.
292511b41d2SMark Murray.It Fl l
293ae1f160dSDag-Erling SmørgravShow fingerprint of specified public key file.
294ae1f160dSDag-Erling SmørgravPrivate RSA1 keys are also supported.
295ae1f160dSDag-Erling SmørgravFor RSA and DSA keys
296ae1f160dSDag-Erling Smørgrav.Nm
297ae1f160dSDag-Erling Smørgravtries to find the matching public key file and prints its fingerprint.
298d4af9e69SDag-Erling SmørgravIf combined with
299d4af9e69SDag-Erling Smørgrav.Fl v ,
300d4af9e69SDag-Erling Smørgravan ASCII art representation of the key is supplied with the fingerprint.
3015e8dbd04SDag-Erling Smørgrav.It Fl M Ar memory
3025e8dbd04SDag-Erling SmørgravSpecify the amount of memory to use (in megabytes) when generating
3035e8dbd04SDag-Erling Smørgravcandidate moduli for DH-GEX.
304e2f6069cSDag-Erling Smørgrav.It Fl m Ar key_format
305e2f6069cSDag-Erling SmørgravSpecify a key format for the
306e2f6069cSDag-Erling Smørgrav.Fl i
307e2f6069cSDag-Erling Smørgrav(import) or
308e2f6069cSDag-Erling Smørgrav.Fl e
309e2f6069cSDag-Erling Smørgrav(export) conversion options.
310e2f6069cSDag-Erling SmørgravThe supported key formats are:
311e2f6069cSDag-Erling Smørgrav.Dq RFC4716
312e2f6069cSDag-Erling Smørgrav(RFC 4716/SSH2 public or private key),
313e2f6069cSDag-Erling Smørgrav.Dq PKCS8
314e2f6069cSDag-Erling Smørgrav(PEM PKCS8 public key)
315e2f6069cSDag-Erling Smørgravor
316e2f6069cSDag-Erling Smørgrav.Dq PEM
317e2f6069cSDag-Erling Smørgrav(PEM public key).
318e2f6069cSDag-Erling SmørgravThe default conversion format is
319e2f6069cSDag-Erling Smørgrav.Dq RFC4716 .
3205e8dbd04SDag-Erling Smørgrav.It Fl N Ar new_passphrase
3215e8dbd04SDag-Erling SmørgravProvides the new passphrase.
322b15c8340SDag-Erling Smørgrav.It Fl n Ar principals
323b15c8340SDag-Erling SmørgravSpecify one or more principals (user or host names) to be included in
324b15c8340SDag-Erling Smørgrava certificate when signing a key.
325b15c8340SDag-Erling SmørgravMultiple principals may be specified, separated by commas.
326b15c8340SDag-Erling SmørgravPlease see the
327b15c8340SDag-Erling Smørgrav.Sx CERTIFICATES
328b15c8340SDag-Erling Smørgravsection for details.
329e2f6069cSDag-Erling Smørgrav.It Fl O Ar option
330e2f6069cSDag-Erling SmørgravSpecify a certificate option when signing a key.
331b15c8340SDag-Erling SmørgravThis option may be specified multiple times.
332b15c8340SDag-Erling SmørgravPlease see the
333b15c8340SDag-Erling Smørgrav.Sx CERTIFICATES
334b15c8340SDag-Erling Smørgravsection for details.
335e2f6069cSDag-Erling SmørgravThe options that are valid for user certificates are:
336b15c8340SDag-Erling Smørgrav.Bl -tag -width Ds
3378ad9b54aSDag-Erling Smørgrav.It Ic clear
3388ad9b54aSDag-Erling SmørgravClear all enabled permissions.
3398ad9b54aSDag-Erling SmørgravThis is useful for clearing the default set of permissions so permissions may
3408ad9b54aSDag-Erling Smørgravbe added individually.
3418ad9b54aSDag-Erling Smørgrav.It Ic force-command Ns = Ns Ar command
3428ad9b54aSDag-Erling SmørgravForces the execution of
3438ad9b54aSDag-Erling Smørgrav.Ar command
3448ad9b54aSDag-Erling Smørgravinstead of any shell or command specified by the user when
3458ad9b54aSDag-Erling Smørgravthe certificate is used for authentication.
346b15c8340SDag-Erling Smørgrav.It Ic no-agent-forwarding
347b15c8340SDag-Erling SmørgravDisable
348b15c8340SDag-Erling Smørgrav.Xr ssh-agent 1
349b15c8340SDag-Erling Smørgravforwarding (permitted by default).
350b15c8340SDag-Erling Smørgrav.It Ic no-port-forwarding
351b15c8340SDag-Erling SmørgravDisable port forwarding (permitted by default).
352b15c8340SDag-Erling Smørgrav.It Ic no-pty
353b15c8340SDag-Erling SmørgravDisable PTY allocation (permitted by default).
354b15c8340SDag-Erling Smørgrav.It Ic no-user-rc
355b15c8340SDag-Erling SmørgravDisable execution of
356b15c8340SDag-Erling Smørgrav.Pa ~/.ssh/rc
357b15c8340SDag-Erling Smørgravby
358b15c8340SDag-Erling Smørgrav.Xr sshd 8
359b15c8340SDag-Erling Smørgrav(permitted by default).
3608ad9b54aSDag-Erling Smørgrav.It Ic no-x11-forwarding
3618ad9b54aSDag-Erling SmørgravDisable X11 forwarding (permitted by default).
362b15c8340SDag-Erling Smørgrav.It Ic permit-agent-forwarding
363b15c8340SDag-Erling SmørgravAllows
364b15c8340SDag-Erling Smørgrav.Xr ssh-agent 1
365b15c8340SDag-Erling Smørgravforwarding.
366b15c8340SDag-Erling Smørgrav.It Ic permit-port-forwarding
367b15c8340SDag-Erling SmørgravAllows port forwarding.
368b15c8340SDag-Erling Smørgrav.It Ic permit-pty
369b15c8340SDag-Erling SmørgravAllows PTY allocation.
370b15c8340SDag-Erling Smørgrav.It Ic permit-user-rc
371b15c8340SDag-Erling SmørgravAllows execution of
372b15c8340SDag-Erling Smørgrav.Pa ~/.ssh/rc
373b15c8340SDag-Erling Smørgravby
374b15c8340SDag-Erling Smørgrav.Xr sshd 8 .
3758ad9b54aSDag-Erling Smørgrav.It Ic permit-x11-forwarding
3768ad9b54aSDag-Erling SmørgravAllows X11 forwarding.
3778ad9b54aSDag-Erling Smørgrav.It Ic source-address Ns = Ns Ar address_list
3788ad9b54aSDag-Erling SmørgravRestrict the source addresses from which the certificate is considered valid.
379b15c8340SDag-Erling SmørgravThe
380b15c8340SDag-Erling Smørgrav.Ar address_list
381b15c8340SDag-Erling Smørgravis a comma-separated list of one or more address/netmask pairs in CIDR
382b15c8340SDag-Erling Smørgravformat.
383b15c8340SDag-Erling Smørgrav.El
384b15c8340SDag-Erling Smørgrav.Pp
385e2f6069cSDag-Erling SmørgravAt present, no options are valid for host keys.
3865e8dbd04SDag-Erling Smørgrav.It Fl P Ar passphrase
3875e8dbd04SDag-Erling SmørgravProvides the (old) passphrase.
388511b41d2SMark Murray.It Fl p
389511b41d2SMark MurrayRequests changing the passphrase of a private key file instead of
390a8f6863aSKris Kennawaycreating a new private key.
391a8f6863aSKris KennawayThe program will prompt for the file
392511b41d2SMark Murraycontaining the private key, for the old passphrase, and twice for the
393511b41d2SMark Murraynew passphrase.
394511b41d2SMark Murray.It Fl q
395511b41d2SMark MurraySilence
396511b41d2SMark Murray.Nm ssh-keygen .
397511b41d2SMark MurrayUsed by
398511b41d2SMark Murray.Pa /etc/rc
399511b41d2SMark Murraywhen creating a new key.
4005e8dbd04SDag-Erling Smørgrav.It Fl R Ar hostname
4015e8dbd04SDag-Erling SmørgravRemoves all keys belonging to
4025e8dbd04SDag-Erling Smørgrav.Ar hostname
4035e8dbd04SDag-Erling Smørgravfrom a
4045e8dbd04SDag-Erling Smørgrav.Pa known_hosts
4055e8dbd04SDag-Erling Smørgravfile.
4065e8dbd04SDag-Erling SmørgravThis option is useful to delete hashed hosts (see the
4075e8dbd04SDag-Erling Smørgrav.Fl H
4085e8dbd04SDag-Erling Smørgravoption above).
4095e8dbd04SDag-Erling Smørgrav.It Fl r Ar hostname
4105e8dbd04SDag-Erling SmørgravPrint the SSHFP fingerprint resource record named
4115e8dbd04SDag-Erling Smørgrav.Ar hostname
4125e8dbd04SDag-Erling Smørgravfor the specified public key file.
4135e8dbd04SDag-Erling Smørgrav.It Fl S Ar start
4145e8dbd04SDag-Erling SmørgravSpecify start point (in hex) when generating candidate moduli for DH-GEX.
415b15c8340SDag-Erling Smørgrav.It Fl s Ar ca_key
416b15c8340SDag-Erling SmørgravCertify (sign) a public key using the specified CA key.
417b15c8340SDag-Erling SmørgravPlease see the
418b15c8340SDag-Erling Smørgrav.Sx CERTIFICATES
419b15c8340SDag-Erling Smørgravsection for details.
4205e8dbd04SDag-Erling Smørgrav.It Fl T Ar output_file
4215e8dbd04SDag-Erling SmørgravTest DH group exchange candidate primes (generated using the
4225e8dbd04SDag-Erling Smørgrav.Fl G
4235e8dbd04SDag-Erling Smørgravoption) for safety.
4241e8db6e2SBrian Feldman.It Fl t Ar type
4255e8dbd04SDag-Erling SmørgravSpecifies the type of key to create.
4261e8db6e2SBrian FeldmanThe possible values are
4271e8db6e2SBrian Feldman.Dq rsa1
4281e8db6e2SBrian Feldmanfor protocol version 1 and
429*4a421b63SDag-Erling Smørgrav.Dq dsa ,
430*4a421b63SDag-Erling Smørgrav.Dq ecdsa
4311e8db6e2SBrian Feldmanor
432*4a421b63SDag-Erling Smørgrav.Dq rsa
4331e8db6e2SBrian Feldmanfor protocol version 2.
434b15c8340SDag-Erling Smørgrav.It Fl V Ar validity_interval
435b15c8340SDag-Erling SmørgravSpecify a validity interval when signing a certificate.
436b15c8340SDag-Erling SmørgravA validity interval may consist of a single time, indicating that the
437b15c8340SDag-Erling Smørgravcertificate is valid beginning now and expiring at that time, or may consist
438b15c8340SDag-Erling Smørgravof two times separated by a colon to indicate an explicit time interval.
439b15c8340SDag-Erling SmørgravThe start time may be specified as a date in YYYYMMDD format, a time
440b15c8340SDag-Erling Smørgravin YYYYMMDDHHMMSS format or a relative time (to the current time) consisting
441b15c8340SDag-Erling Smørgravof a minus sign followed by a relative time in the format described in the
442b15c8340SDag-Erling Smørgrav.Sx TIME FORMATS
443b15c8340SDag-Erling Smørgravsection of
4448ad9b54aSDag-Erling Smørgrav.Xr sshd_config 5 .
445b15c8340SDag-Erling SmørgravThe end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMMSS time or
446b15c8340SDag-Erling Smørgrava relative time starting with a plus character.
447b15c8340SDag-Erling Smørgrav.Pp
448b15c8340SDag-Erling SmørgravFor example:
449b15c8340SDag-Erling Smørgrav.Dq +52w1d
450b15c8340SDag-Erling Smørgrav(valid from now to 52 weeks and one day from now),
451b15c8340SDag-Erling Smørgrav.Dq -4w:+4w
452b15c8340SDag-Erling Smørgrav(valid from four weeks ago to four weeks from now),
453b15c8340SDag-Erling Smørgrav.Dq 20100101123000:20110101123000
454b15c8340SDag-Erling Smørgrav(valid from 12:30 PM, January 1st, 2010 to 12:30 PM, January 1st, 2011),
455b15c8340SDag-Erling Smørgrav.Dq -1d:20110101
456b15c8340SDag-Erling Smørgrav(valid from yesterday to midnight, January 1st, 2011).
457efcad6b7SDag-Erling Smørgrav.It Fl v
458efcad6b7SDag-Erling SmørgravVerbose mode.
459efcad6b7SDag-Erling SmørgravCauses
460efcad6b7SDag-Erling Smørgrav.Nm
461efcad6b7SDag-Erling Smørgravto print debugging messages about its progress.
462efcad6b7SDag-Erling SmørgravThis is helpful for debugging moduli generation.
463efcad6b7SDag-Erling SmørgravMultiple
464efcad6b7SDag-Erling Smørgrav.Fl v
465efcad6b7SDag-Erling Smørgravoptions increase the verbosity.
466efcad6b7SDag-Erling SmørgravThe maximum is 3.
4675e8dbd04SDag-Erling Smørgrav.It Fl W Ar generator
4685e8dbd04SDag-Erling SmørgravSpecify desired generator when testing candidate moduli for DH-GEX.
4695e8dbd04SDag-Erling Smørgrav.It Fl y
4705e8dbd04SDag-Erling SmørgravThis option will read a private
4715e8dbd04SDag-Erling SmørgravOpenSSH format file and print an OpenSSH public key to stdout.
472e2f6069cSDag-Erling Smørgrav.It Fl z Ar serial_number
473e2f6069cSDag-Erling SmørgravSpecifies a serial number to be embedded in the certificate to distinguish
474e2f6069cSDag-Erling Smørgravthis certificate from others from the same CA.
475e2f6069cSDag-Erling SmørgravThe default serial number is zero.
476511b41d2SMark Murray.El
477d95e11bfSDag-Erling Smørgrav.Sh MODULI GENERATION
478d95e11bfSDag-Erling Smørgrav.Nm
479d95e11bfSDag-Erling Smørgravmay be used to generate groups for the Diffie-Hellman Group Exchange
480d95e11bfSDag-Erling Smørgrav(DH-GEX) protocol.
481d95e11bfSDag-Erling SmørgravGenerating these groups is a two-step process: first, candidate
482d95e11bfSDag-Erling Smørgravprimes are generated using a fast, but memory intensive process.
483d95e11bfSDag-Erling SmørgravThese candidate primes are then tested for suitability (a CPU-intensive
484d95e11bfSDag-Erling Smørgravprocess).
485d95e11bfSDag-Erling Smørgrav.Pp
486d95e11bfSDag-Erling SmørgravGeneration of primes is performed using the
487d95e11bfSDag-Erling Smørgrav.Fl G
488d95e11bfSDag-Erling Smørgravoption.
489d95e11bfSDag-Erling SmørgravThe desired length of the primes may be specified by the
490d95e11bfSDag-Erling Smørgrav.Fl b
491d95e11bfSDag-Erling Smørgravoption.
492d95e11bfSDag-Erling SmørgravFor example:
493d95e11bfSDag-Erling Smørgrav.Pp
4945e8dbd04SDag-Erling Smørgrav.Dl # ssh-keygen -G moduli-2048.candidates -b 2048
495d95e11bfSDag-Erling Smørgrav.Pp
496d95e11bfSDag-Erling SmørgravBy default, the search for primes begins at a random point in the
497d95e11bfSDag-Erling Smørgravdesired length range.
498d95e11bfSDag-Erling SmørgravThis may be overridden using the
499d95e11bfSDag-Erling Smørgrav.Fl S
500d95e11bfSDag-Erling Smørgravoption, which specifies a different start point (in hex).
501d95e11bfSDag-Erling Smørgrav.Pp
502d95e11bfSDag-Erling SmørgravOnce a set of candidates have been generated, they must be tested for
503d95e11bfSDag-Erling Smørgravsuitability.
504d95e11bfSDag-Erling SmørgravThis may be performed using the
505d95e11bfSDag-Erling Smørgrav.Fl T
506d95e11bfSDag-Erling Smørgravoption.
507d95e11bfSDag-Erling SmørgravIn this mode
508d95e11bfSDag-Erling Smørgrav.Nm
509d95e11bfSDag-Erling Smørgravwill read candidates from standard input (or a file specified using the
510d95e11bfSDag-Erling Smørgrav.Fl f
511d95e11bfSDag-Erling Smørgravoption).
512d95e11bfSDag-Erling SmørgravFor example:
513d95e11bfSDag-Erling Smørgrav.Pp
5145e8dbd04SDag-Erling Smørgrav.Dl # ssh-keygen -T moduli-2048 -f moduli-2048.candidates
515d95e11bfSDag-Erling Smørgrav.Pp
516d95e11bfSDag-Erling SmørgravBy default, each candidate will be subjected to 100 primality tests.
517d95e11bfSDag-Erling SmørgravThis may be overridden using the
518d95e11bfSDag-Erling Smørgrav.Fl a
519d95e11bfSDag-Erling Smørgravoption.
520d95e11bfSDag-Erling SmørgravThe DH generator value will be chosen automatically for the
521d95e11bfSDag-Erling Smørgravprime under consideration.
522d95e11bfSDag-Erling SmørgravIf a specific generator is desired, it may be requested using the
523d95e11bfSDag-Erling Smørgrav.Fl W
524d95e11bfSDag-Erling Smørgravoption.
5255e8dbd04SDag-Erling SmørgravValid generator values are 2, 3, and 5.
526d95e11bfSDag-Erling Smørgrav.Pp
527d95e11bfSDag-Erling SmørgravScreened DH groups may be installed in
528d95e11bfSDag-Erling Smørgrav.Pa /etc/moduli .
529d95e11bfSDag-Erling SmørgravIt is important that this file contains moduli of a range of bit lengths and
530d95e11bfSDag-Erling Smørgravthat both ends of a connection share common moduli.
531b15c8340SDag-Erling Smørgrav.Sh CERTIFICATES
532b15c8340SDag-Erling Smørgrav.Nm
533b15c8340SDag-Erling Smørgravsupports signing of keys to produce certificates that may be used for
534b15c8340SDag-Erling Smørgravuser or host authentication.
535b15c8340SDag-Erling SmørgravCertificates consist of a public key, some identity information, zero or
536e2f6069cSDag-Erling Smørgravmore principal (user or host) names and a set of options that
537b15c8340SDag-Erling Smørgravare signed by a Certification Authority (CA) key.
538b15c8340SDag-Erling SmørgravClients or servers may then trust only the CA key and verify its signature
539b15c8340SDag-Erling Smørgravon a certificate rather than trusting many user/host keys.
540b15c8340SDag-Erling SmørgravNote that OpenSSH certificates are a different, and much simpler, format to
541b15c8340SDag-Erling Smørgravthe X.509 certificates used in
542b15c8340SDag-Erling Smørgrav.Xr ssl 8 .
543b15c8340SDag-Erling Smørgrav.Pp
544b15c8340SDag-Erling Smørgrav.Nm
545b15c8340SDag-Erling Smørgravsupports two types of certificates: user and host.
546b15c8340SDag-Erling SmørgravUser certificates authenticate users to servers, whereas host certificates
547b15c8340SDag-Erling Smørgravauthenticate server hosts to users.
548b15c8340SDag-Erling SmørgravTo generate a user certificate:
549b15c8340SDag-Erling Smørgrav.Pp
550b15c8340SDag-Erling Smørgrav.Dl $ ssh-keygen -s /path/to/ca_key -I key_id /path/to/user_key.pub
551b15c8340SDag-Erling Smørgrav.Pp
552b15c8340SDag-Erling SmørgravThe resultant certificate will be placed in
5538ad9b54aSDag-Erling Smørgrav.Pa /path/to/user_key-cert.pub .
554b15c8340SDag-Erling SmørgravA host certificate requires the
555b15c8340SDag-Erling Smørgrav.Fl h
556b15c8340SDag-Erling Smørgravoption:
557b15c8340SDag-Erling Smørgrav.Pp
558b15c8340SDag-Erling Smørgrav.Dl $ ssh-keygen -s /path/to/ca_key -I key_id -h /path/to/host_key.pub
559b15c8340SDag-Erling Smørgrav.Pp
560b15c8340SDag-Erling SmørgravThe host certificate will be output to
5618ad9b54aSDag-Erling Smørgrav.Pa /path/to/host_key-cert.pub .
562e2f6069cSDag-Erling Smørgrav.Pp
563e2f6069cSDag-Erling SmørgravIt is possible to sign using a CA key stored in a PKCS#11 token by
564e2f6069cSDag-Erling Smørgravproviding the token library using
565e2f6069cSDag-Erling Smørgrav.Fl D
566e2f6069cSDag-Erling Smørgravand identifying the CA key by providing its public half as an argument
567e2f6069cSDag-Erling Smørgravto
568e2f6069cSDag-Erling Smørgrav.Fl s :
569e2f6069cSDag-Erling Smørgrav.Pp
570e2f6069cSDag-Erling Smørgrav.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id host_key.pub
571e2f6069cSDag-Erling Smørgrav.Pp
572e2f6069cSDag-Erling SmørgravIn all cases,
573b15c8340SDag-Erling Smørgrav.Ar key_id
574b15c8340SDag-Erling Smørgravis a "key identifier" that is logged by the server when the certificate
575b15c8340SDag-Erling Smørgravis used for authentication.
576b15c8340SDag-Erling Smørgrav.Pp
577b15c8340SDag-Erling SmørgravCertificates may be limited to be valid for a set of principal (user/host)
578b15c8340SDag-Erling Smørgravnames.
579b15c8340SDag-Erling SmørgravBy default, generated certificates are valid for all users or hosts.
580b15c8340SDag-Erling SmørgravTo generate a certificate for a specified set of principals:
581b15c8340SDag-Erling Smørgrav.Pp
582b15c8340SDag-Erling Smørgrav.Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
5838ad9b54aSDag-Erling Smørgrav.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub"
584b15c8340SDag-Erling Smørgrav.Pp
585b15c8340SDag-Erling SmørgravAdditional limitations on the validity and use of user certificates may
586e2f6069cSDag-Erling Smørgravbe specified through certificate options.
587e2f6069cSDag-Erling SmørgravA certificate option may disable features of the SSH session, may be
588b15c8340SDag-Erling Smørgravvalid only when presented from particular source addresses or may
589b15c8340SDag-Erling Smørgravforce the use of a specific command.
590e2f6069cSDag-Erling SmørgravFor a list of valid certificate options, see the documentation for the
591b15c8340SDag-Erling Smørgrav.Fl O
592b15c8340SDag-Erling Smørgravoption above.
593b15c8340SDag-Erling Smørgrav.Pp
594b15c8340SDag-Erling SmørgravFinally, certificates may be defined with a validity lifetime.
595b15c8340SDag-Erling SmørgravThe
596b15c8340SDag-Erling Smørgrav.Fl V
597b15c8340SDag-Erling Smørgravoption allows specification of certificate start and end times.
598b15c8340SDag-Erling SmørgravA certificate that is presented at a time outside this range will not be
599b15c8340SDag-Erling Smørgravconsidered valid.
600b15c8340SDag-Erling SmørgravBy default, certificates have a maximum validity interval.
601b15c8340SDag-Erling Smørgrav.Pp
602b15c8340SDag-Erling SmørgravFor certificates to be used for user or host authentication, the CA
603b15c8340SDag-Erling Smørgravpublic key must be trusted by
604b15c8340SDag-Erling Smørgrav.Xr sshd 8
605b15c8340SDag-Erling Smørgravor
606b15c8340SDag-Erling Smørgrav.Xr ssh 1 .
607b15c8340SDag-Erling SmørgravPlease refer to those manual pages for details.
608511b41d2SMark Murray.Sh FILES
609*4a421b63SDag-Erling Smørgrav.Bl -tag -width Ds -compact
610043840dfSDag-Erling Smørgrav.It Pa ~/.ssh/identity
6111e8db6e2SBrian FeldmanContains the protocol version 1 RSA authentication identity of the user.
612a8f6863aSKris KennawayThis file should not be readable by anyone but the user.
613a8f6863aSKris KennawayIt is possible to
614511b41d2SMark Murrayspecify a passphrase when generating the key; that passphrase will be
615*4a421b63SDag-Erling Smørgravused to encrypt the private part of this file using 3DES.
616a8f6863aSKris KennawayThis file is not automatically accessed by
617511b41d2SMark Murray.Nm
618511b41d2SMark Murraybut it is offered as the default file for the private key.
619ae1f160dSDag-Erling Smørgrav.Xr ssh 1
620a04a10f8SKris Kennawaywill read this file when a login attempt is made.
621*4a421b63SDag-Erling Smørgrav.Pp
622043840dfSDag-Erling Smørgrav.It Pa ~/.ssh/identity.pub
6231e8db6e2SBrian FeldmanContains the protocol version 1 RSA public key for authentication.
624a8f6863aSKris KennawayThe contents of this file should be added to
625043840dfSDag-Erling Smørgrav.Pa ~/.ssh/authorized_keys
626511b41d2SMark Murrayon all machines
627ae1f160dSDag-Erling Smørgravwhere the user wishes to log in using RSA authentication.
628a8f6863aSKris KennawayThere is no need to keep the contents of this file secret.
629*4a421b63SDag-Erling Smørgrav.Pp
630043840dfSDag-Erling Smørgrav.It Pa ~/.ssh/id_dsa
631*4a421b63SDag-Erling Smørgrav.It Pa ~/.ssh/id_ecdsa
632043840dfSDag-Erling Smørgrav.It Pa ~/.ssh/id_rsa
633*4a421b63SDag-Erling SmørgravContains the protocol version 2 DSA, ECDSA or RSA authentication identity of the user.
6341e8db6e2SBrian FeldmanThis file should not be readable by anyone but the user.
6351e8db6e2SBrian FeldmanIt is possible to
6361e8db6e2SBrian Feldmanspecify a passphrase when generating the key; that passphrase will be
637b15c8340SDag-Erling Smørgravused to encrypt the private part of this file using 128-bit AES.
6381e8db6e2SBrian FeldmanThis file is not automatically accessed by
6391e8db6e2SBrian Feldman.Nm
6401e8db6e2SBrian Feldmanbut it is offered as the default file for the private key.
641ae1f160dSDag-Erling Smørgrav.Xr ssh 1
6421e8db6e2SBrian Feldmanwill read this file when a login attempt is made.
643*4a421b63SDag-Erling Smørgrav.Pp
644*4a421b63SDag-Erling Smørgrav.It Pa ~/.ssh/id_dsa.pub
645*4a421b63SDag-Erling Smørgrav.It Pa ~/.ssh/id_ecdsa.pub
646043840dfSDag-Erling Smørgrav.It Pa ~/.ssh/id_rsa.pub
647*4a421b63SDag-Erling SmørgravContains the protocol version 2 DSA, ECDSA or RSA public key for authentication.
6481e8db6e2SBrian FeldmanThe contents of this file should be added to
649043840dfSDag-Erling Smørgrav.Pa ~/.ssh/authorized_keys
6501e8db6e2SBrian Feldmanon all machines
651ae1f160dSDag-Erling Smørgravwhere the user wishes to log in using public key authentication.
652a04a10f8SKris KennawayThere is no need to keep the contents of this file secret.
653*4a421b63SDag-Erling Smørgrav.Pp
654d95e11bfSDag-Erling Smørgrav.It Pa /etc/moduli
655d95e11bfSDag-Erling SmørgravContains Diffie-Hellman groups used for DH-GEX.
656d95e11bfSDag-Erling SmørgravThe file format is described in
657d95e11bfSDag-Erling Smørgrav.Xr moduli 5 .
658b66f2d16SKris Kennaway.El
659511b41d2SMark Murray.Sh SEE ALSO
660511b41d2SMark Murray.Xr ssh 1 ,
661511b41d2SMark Murray.Xr ssh-add 1 ,
662511b41d2SMark Murray.Xr ssh-agent 1 ,
663d95e11bfSDag-Erling Smørgrav.Xr moduli 5 ,
6641e8db6e2SBrian Feldman.Xr sshd 8
6651e8db6e2SBrian Feldman.Rs
666d4af9e69SDag-Erling Smørgrav.%R RFC 4716
667d4af9e69SDag-Erling Smørgrav.%T "The Secure Shell (SSH) Public Key File Format"
668d4af9e69SDag-Erling Smørgrav.%D 2006
6691e8db6e2SBrian Feldman.Re
670d95e11bfSDag-Erling Smørgrav.Sh AUTHORS
671d95e11bfSDag-Erling SmørgravOpenSSH is a derivative of the original and free
672d95e11bfSDag-Erling Smørgravssh 1.2.12 release by Tatu Ylonen.
673d95e11bfSDag-Erling SmørgravAaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
674d95e11bfSDag-Erling SmørgravTheo de Raadt and Dug Song
675d95e11bfSDag-Erling Smørgravremoved many bugs, re-added newer features and
676d95e11bfSDag-Erling Smørgravcreated OpenSSH.
677d95e11bfSDag-Erling SmørgravMarkus Friedl contributed the support for SSH
678d95e11bfSDag-Erling Smørgravprotocol versions 1.5 and 2.0.
679